Banco Santander, S.A.

2025 ICFR monitoring activities and results

Our board-approved internal audit corporate framework sets out the definition, objectives and principles that govern the function’s operations. Its mission is to provide the board of directors and senior management with independent assurance on the quality and effectiveness of internal control processes and systems, risk management (both current and emerging) and governance, thereby contributing to the protection of the Group’s value, solvency and reputation.

The internal audit function reports directly to the audit committee and, at least twice a year, to the board of directors, maintaining functional independence at all times and direct access to the board when required.

Internal audit assesses:

•the efficiency and effectiveness of the ICFR;

•compliance with applicable regulations and supervisory requirements;

•the reliability and integrity of financial and operational information; and

•asset integrity.

Its scope of action includes:

•all Group entities over which effective control is exercised;

•separated assets (for example, mutual funds) managed by the entities mentioned in the previous section; and

•any entity (or separated assets) not included in the above points with which the Group has entered into an express agreement to provide internal audits.

This subjective scope includes our activities, businesses and processes (performed internally or through outsourcing), the organization and, where applicable, branch networks. Internal audit may also conduct audits for other investees that are not included in the preceding points when the Group has reserved this right as a shareholder, as well as on outsourced activities in accordance with the established agreements.

The audit committee regularly assesses the functioning and effectiveness of the internal audit function, as well as the performance of its head, ensuring that it has the appropriate resources. For more details, see section 4.5 'Audit committee activities in 2025'.

As at 2025 year-end, the Internal Audit division had 1,272 employees, all exclusively dedicated to this service. Of these, 304 were based at the Corporate Centre and 968 in the local units located in the Group's core markets.

The internal audit function prepares an annual audit plan based on its own risk assessment, which determines and prioritizes the

Annual report 2025364

reviews to be carried out during the year. This plan constitutes the framework for the execution of audit activities.

At its meeting on 20 February 2025, the audit committee gave the green light to the internal audit plan for 2025, which the board of directors subsequently approved at its meeting on 25 February 2025.

Reviews may give rise to recommendations, which we prioritize according to their relative importance and are subject to ongoing follow-up until their full implementation.

The internal audit function reports on the ICFR have mainly aimed to:

•verify compliance with the provisions contained in sections 302, 404, 406, 407 and 806 of the SOx Act;

•check corporate governance with regard to information relating to the ICFR, including risk culture;

•review the functions performed by the internal control departments and by other departments, areas and divisions that work to ensure compliance with the SOx Act;

•make sure the supporting documentation relating to the SOx Act is up to date;

•confirm the effectiveness of a sample of controls based on an internal audit risk assessment methodology;

•assess the accuracy of the unit's certifications, especially their consistency with respect to the observations and recommendations made by internal audit, the external auditors of the annual accounts and supervisors; and

•ratify the implementation of recommendations made in the audit plan.

In 2025, the audit committee and the board of directors were regularly informed of the internal audit function's work in accordance with its annual plan, as well as of other related matters. For more details, see section 4.5 'Audit committee activities in 2025'.

Detection and management of deficiencies

As part of its remit to supervise financial reporting and ICS, the audit committee is responsible for maintaining continuous dialogue with the external auditor regarding any significant weaknesses detected in the audit.

It also assesses the results of the work carried out by internal audit and, where appropriate, adopts the necessary measures to address any deficiencies identified in the financial information that could affect the reliability and accuracy of the annual accounts. For this purpose, it may liaise with the various Group areas involved to obtain the necessary information and clarification. It also assesses the potential impact of any error identified in the financial information.

During 2025, the audit committee was informed of the results of the assessment and certification of the ICS corresponding to the 2024 financial year. No material weaknesses or significant deficiencies were identified in the ICFR at Group level. For more details, see section 4.5 'Audit committee activities in 2025'.

Annual report 2025365

[Page intentionally left blank]1 of 3

Annual report 2025366

[Page intentionally left blank] 2 of 3

Annual report 2025367

[Page intentionally left blank] 3 of 3

Annual report 2025368